random RTMP crash

[K.Y.H]

When internet connection is break or time-out is short...
Sometime crash is occur.

Backtrace is follow.

Program terminated with signal 11, Segmentation fault.
#0 0x0000003d222728ae in free () from /lib64/libc.so.6
(gdb) bt
#0 0x0000003d222728ae in free () from /lib64/libc.so.6
#1 0x0000000000b9dc1c in av_free (arg=0x2aab3b1be6a8) at libavutil/mem.c:232
#2 av_freep (arg=0x2aab3b1be6a8) at libavutil/mem.c:239
#3 0x0000000000528fe5 in ff_rtmp_packet_destroy (h=0x1a21c4a0, p=0x2aab3b1be690, chunk_size=4096, prev_pkt_ptr=<value optimized out>,

nb_prev_pkt=<value optimized out>, hdr=100 'd') at libavformat/rtmppkt.c:410

#4 rtmp_packet_read_one_chunk (h=0x1a21c4a0, p=0x2aab3b1be690, chunk_size=4096, prev_pkt_ptr=<value optimized out>, nb_prev_pkt=<value optimized out>,

hdr=100 'd') at libavformat/rtmppkt.c:264

#5 0x000000000052922a in ff_rtmp_packet_read_internal (h=0x1a21c4a0, p=0x2aab3b1be690, chunk_size=4096, prev_pkt=0x1a21c050, nb_prev_pkt=0x1a21c060)

at libavformat/rtmppkt.c:289

#6 ff_rtmp_packet_read (h=0x1a21c4a0, p=0x2aab3b1be690, chunk_size=4096, prev_pkt=0x1a21c050, nb_prev_pkt=0x1a21c060) at libavformat/rtmppkt.c:161
#7 0x00000000004cf309 in get_packet (s=0x1a21bfc0, for_header=<value optimized out>) at libavformat/rtmpproto.c:2262
#8 0x00000000004cf78e in rtmp_read (s=0x2aab7a62a040, buf=0x1a22e7e0 "\b", size=32768) at libavformat/rtmpproto.c:2628
#9 0x000000000043d411 in retry_transfer_wrapper (h=0x1a21bfc0, buf=0x1a22e7e0 "\b", size=32768) at libavformat/avio.c:303
#10 ffurl_read (h=0x1a21bfc0, buf=0x1a22e7e0 "\b", size=32768) at libavformat/avio.c:334
#11 0x000000000043dfa3 in fill_buffer (s=0x1a21d220) at libavformat/aviobuf.c:449
#12 0x000000000043e0d5 in avio_r8 (s=0x2aab7a62a040) at libavformat/aviobuf.c:495
#13 0x0000000000452dcc in flv_read_packet (s=0x1a21b9c0, pkt=0x2aab3b1be950) at libavformat/flvdec.c:771
#14 0x0000000000508f0e in ff_read_packet (s=0x1a21b9c0, pkt=0x2aab3b1be950) at libavformat/utils.c:767
#15 0x000000000050b45b in read_frame_internal (s=0x1a21b9c0, pkt=0x2aab3b1c9ef0) at libavformat/utils.c:1436
#16 0x000000000050c29a in av_read_frame (s=0x2aab7a62a040, pkt=0x2aab3b1c9ef0) at libavformat/utils.c:1573

That is can be fix by...
rtmppkt.c

static int rtmp_packet_read_one_chunk(URLContext *h, RTMPPacket *p,
                                      int chunk_size, RTMPPacket **prev_pkt_ptr,
                                      int *nb_prev_pkt, uint8_t hdr)
....
....
....
    if (size > 0) {
       RTMPPacket *prev = &prev_pkt[channel_id];
       prev->data = p->data;
       prev->read = p->read;
       prev->offset = p->offset;
       // added by K.Y.H for fix crash....
       p->data	    = NULL;
       return AVERROR(EAGAIN);
    }

    prev_pkt[channel_id].read = 0; // read complete; reset if needed
    return p->read;
}

[Carl Eugen Hoyos]

If you have a patch fixing this crash, please send it (formatted with git format-patch to the ffmpeg-devel mailing list.

If you cannot send a patch, please provide complete valgrind output.

[K.Y.H]

I attach diff file and rtmppkt.c.

[Carl Eugen Hoyos]

Unfortunately, patches attached on this bug tracker are often ignored. Please commit your patch locally with git commit libavformat/rtmppkt.c and create a patch with git format-patch HEAD^. Then send the resulting file (0001-...) to the ffmpeg-devel mailing list where it will be reviewed.
Don't forget that tabs cannot be committed to the FFmpeg repository, respect the existing indentation and please remove the comment: git blame tells everybody that you wrote the patch.
If possible, add Fixes ticket #3564 to the commit message.

[Michael Niedermayer]

Fixed in f21c263c8979aa8a71c1c10909efb991679045c1